Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.221entry #116

Claude Code v2.1.221 ·

MCP OAuth handles the RFC 9207 issuer parameter

MCP OAuth logins now verify the issuer and give clearer errors when client registration is rejected.

You'll notice Improvements
JSON All of v2.1.221
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
MCPArea: what it touches
ImprovementsKind: in v2.1.221,
ImprovementsSection of the release
What

Loopback and manual-URL OAuth callbacks now read iss from the query string and carry it into token exchange, and saved MCP tokens record the issuer.

Details
  • Token exchange receives authorizationCode: d.code, iss: d.iss.
  • Saved tokens gain an issuer field; an unexpected-issuer check runs when the authorization server advertises iss support.
  • New failure classification "dcr_rejected" separates a rejected dynamic client registration from the existing "dcr_failed".
  • OAuth error matching moved off message and errorCode sniffing onto typed SDK errors read via .code, covering invalid_client, unauthorized_client and InvalidGrant.
Evidence

dcr_rejected

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.221 →

Feedback